A tracing framework is used to understand the behavior of complex computer systems. Tracing performed using the tracing framework involves recording data from a location or occurrence in the software of the computer system. In a tracing framework that offers comprehensive coverage, the framework provides a mechanism to allow events not to be traced or the user may be flooded with unwanted data.
Tracing frameworks use predicates to limit the events traced by only tracing data if a certain condition is found to be true. Predicates are a useful mechanism when the user knows whether the probe event is interesting when a probe is triggered. For example, if the user is only interested in an activity associated with a certain process or a certain file descriptor, the user can define a predicate that obtains knowledge about only that particular process or file descriptor when the probe is triggered.
However, some situations exist when the user may not have knowledge whether a given probe event is interesting at the time that the probe is triggered. Often the user can only make the determination that the probe event is interesting after the probe is triggered.
For example, if a function with the software of a computer system is failing in an irregular manner with a common error code, the user may wish to better understand the code path that is leading to the error condition. To capture the code path, the user could enable every probe—but only if the failing function call can be isolated in such a way that meaningful predicates can be defined. If the failures are sporadic or non-deterministic, the user is forced to trace all events that may be interesting, and later use post-process analysis of the data to filter out particular data that is not associated with the failing code path. In this case, even though the number of interesting events may be reasonably small, the number of events to analyze during post-process analysis and that must be traced is very large.